{"id":"openSUSE-SU-2026:22162-1","summary":"Security update for haproxy","details":"This update for haproxy fixes the following issue:\n\n- h1-htx: report an error on a too long chunk-size line (bsc#1285046).\n\nChanges for haproxy:\n\n- Otel Update to version 2.3.0+git2.b031728:\n * DOC: otel: added a security policy to the repository\n * MINOR: otel: test: added a test with an optional upstream context\n * VERSION: otel: bumped filter version to 2.3.0\n * DOC: otel: shortened the repeated passages of the implementation guide\n * BUG/MINOR: otel: left a baggage pair out when its sample yielded nothing\n * DOC: otel: completed the stream stop notes and the function reference\n * DOC: otel: added the load-time warnings and missing rules to the guides\n * DOC: otel: corrected stale statements across the guides and notes\n * DOC: otel: corrected and completed the keyword guides\n * CLEANUP: otel: marked the code that cannot run with a NOTE comment\n * CLEANUP: otel: described the invalid-character check modes\n * MINOR: otel: checked the context field key against the W3C rules\n * DOC: otel: added an overview of the tests\n * MINOR: otel: reported the event pairings on the line that completes them\n * MINOR: otel: warned about an otel-scope that never runs\n * MINOR: otel: enforced the root span rules\n * MINOR: otel: validated the span and context names of every reference\n * MINOR: otel: enforced the rules of the inject and extract context names\n * MINOR: otel: bound the instrument lines of one name to a single owner\n * MINOR: otel: let a key repeat once per condition, first match applied\n * MINOR: otel: gave the 'link' keyword a condition and let it repeat\n * MINOR: otel: allowed the 'otel-stop' keyword to be repeated\n * MINOR: otel: ended a sample list at a repeated clause of the same line\n * MINOR: otel: separated a repeated span line from a redefinition\n * MINOR: otel: checked the metric instrument line against the SDK rules\n * MINOR: otel: allowed each otel-instrumentation keyword only once\n * MINOR: otel: required the configuration to live inside an OTel scope\n * MINOR: otel: allowed the configuration sections in any order\n * MINOR: otel: rejected a bare 'if' or 'unless' with no ACL term\n * MINOR: otel: made an ACL name unique within its section\n * BUG/MINOR: otel: allowed a condition to mix ACLs from the three lists\n * MINOR: otel: refused the reserved words as names and limited the length\n * MINOR: otel: named the sample key where the value stands on its own\n * BUG/MINOR: otel: read the whole filter line before its configuration\n * BUG/MINOR: otel: allowed a repeated sample expression in one value\n * BUG/MINOR: otel: stopped measuring a sample expression as a name\n * BUG/MINOR: otel: named the 'config' keyword in its own parse error\n * CLEANUP: otel: compared the baggage carrier key without case folding\n * CLEANUP: otel: replaced the word 'verbatim' in the comments and guides\n * CLEANUP: otel: added the entry traces to the functions that lacked them\n * CLEANUP: otel: collected the repeated error messages into macros\n * MINOR: otel: test: added the configuration parser test\n * DOC: otel: added the keyword definition rules and updated the guides\n * CLEANUP: otel: replaced the word 'gate' in the comments and guides\n * MINOR: otel: warned about the events the filter placement never fires\n * BUG/MINOR: otel: kept a backend filter from re-running the frontend rules\n * BUG/MINOR: otel: fired on-server-unavailable when no server was reached\n * BUG/MINOR: otel: armed the idle timer for a filter of a backend section\n * MINOR: otel: required every otel-group to be named on a 'groups' line\n * BUG/MINOR: otel: cleared the section state after an aborted parse\n * BUG/MINOR: otel: gave the events that run on no channel a usable direction\n * CLEANUP: otel: used the span event dump macro where the events are handled\n * MINOR: otel: checked 'extract use-headers' against the scope event\n * BUG/MINOR: otel: kept the session alive when a root scope is skipped\n * CLEANUP: otel: collected the session disabling into one function\n * LICENSE: otel: added the LICENSE file and moved the headers to the GPL\n * MINOR: otel: added a sampler level to the speed test\n * MINOR: otel: evaluated the samples in a trash buffer\n * MEDIUM: otel: skipped the samples of a span that records nothing\n- Update to version 3.4.7+git0.8872a2604:\n * [RELEASE] Released version 3.4.7\n * BUG/MAJOR: h1-htx: report an error on a too long chunk-size line (bsc#1285046)\n * BUG/MAJOR: mux-h2: properly handle short reads on PING frames\n * BUG/MINOR: cfgparse-global: only warn when \"localpeer\" is set together with -L\n * REGTEST: ssl: require OpenSSL 1.1.1 for crt-list ciphersuites tests\n * REGTESTS: http-messaging: Fix http_fail_cnt_body to succeed with small timeouts\n * BUG/MEDIUM: mux-h1: only accept the H2 preface on the first request\n * BUG/MINOR: http-fetch: don't report pseudo-headers in TCP mode\n * BUG/MEDIUM: mux-h1: also release the embryonic stream when the error is empty\n * BUG/MEDIUM: mux-h2: fix a possible crash on rxbuf allocation failure\n * BUG/MEDIUM: mux-h2: report a dead rhttp connection in h2_wake()\n * BUG/MEDIUM: mux-h1: don't pass an upgraded connection to traces in h1s_destroy()\n * BUG/MEDIUM: mux-fcgi: don't return a freed tasklet from fcgi_deferred_shut()\n * BUG/MEDIUM: mux-h2: don't return a freed tasklet from h2_deferred_shut()\n * BUG/MINOR: hlua: assume proxy_find_by_id() may return NULL on previously existing server\n * BUG/MINOR: spoe: Fix the message list splice with an empty list\n * REGTESTS: log: check that a log-forward TCP session ends on client close\n * BUG/MEDIUM: log: do not ignore the peer's shutdown in the syslog applet\n * REGTESTS: cli: test a command line of exactly tune.bufsize bytes\n * BUG/MEDIUM: cli: fix the last command detection on a full command line\n * BUG/MINOR: cfgparse-listen: complete the list of options for the suggestions\n * BUG/MINOR: proxy: also look for the closest option among cfg_opts3\n * BUG/MINOR: cfgparse-listen: properly reject extra args in a backend section\n * BUG/MINOR: cfgparse-listen: fix quoting of the condition conflict warning\n * BUG/MINOR: cfgparse-listen: fix the argument checked by \"email-alert\"\n * BUG/MINOR: cfgparse-listen: release the previous description of the proxy\n * BUG/MINOR: cfgparse-global: add missing calloc() check for the global description\n * BUG/MINOR: cfgparse-global: add missing gotos to error label in max-spread-checks\n * BUG/MAJOR: cfgparse: properly check userlist section when scanning keywords\n * MINOR: doc: elaborate on diagnostic mode behavior\n * BUG/MINOR: ssl: Fix potential NULL-deref in \"dump ssl cert\" with AWS-LC\n * BUG/MINOR: h3: reject RS/SS for QPACK uni streams\n * BUG/MINOR: h3: close connection on GOAWAY frame too long\n * BUG/MINOR: h3: reject frames with truncated header\n * BUG/MINOR: mux_quic: extend FINAL_SIZE_ERROR detection on stream\n * BUG/MINOR: ssl: use standard names for X25519 and X448 groups\n * BUG/MEDIUM: listener: Consider maxconn before waking listeners\n * BUG/MEDIUM: ssl: crt-list curves ignored with AWS-LC\n * BUG/MEDIUM: ssl: crt-list ciphers ignored with AWS-LC\n * BUG/MINOR: ssl: fix trace crash on BE conn release in io cb\n * BUG/MINOR: ssl: fix trace crash on FE conn release in io cb\n * BUG/MINOR: hq-interop: prevent double EOM on request with standalone FIN\n * BUG/MINOR: log: fix erroneous error message in log-steps parser\n * MINOR: http-ana: automatically enable http-no-delay for streaming events (SSE)\n * BUG/MINOR: cli: update wait help usage\n * BUG/MINOR: server: fix \"del server\" description\n * BUG/MINOR: proxy: add PR_CAP_LB for dynamically added backend\n * DOC: config: mention that url_ip and url_port fail when passed a name\n * DOC: config: fix doc for hex2i() converter on unparsable input\n * DOC: config: mention other responses not blocked by option checkcache\n * BUG/MINOR: sample: return the decoded JWT part when no path is given\n * BUG/MEDIUM: tcpcheck: do not run a regex on an unallocated buffer\n * BUG/MINOR: http-fetch: do not count Set-Cookie attributes as cookies\n * BUG/MINOR: payload: always report a boolean from req.ssl_ec_ext\n * BUG/MINOR: stick-table: do not count the lookup itself in table_trackers()\n * BUG/MINOR: http-ana: return a 502 when checkcache blocks a response\n * BUG/MINOR: sample: make quic_enabled() always succeed\n * BUG/MINOR: sample: zero-pad the fractional part emitted by http_date()\n * BUG/MINOR: sample: apply the ms_/us_ time offsets in the input unit\n * BUG/MINOR: http: do not consume the delimiter of a truncated q-factor\n * BUG/MINOR: jwe: Avoid buffer overflow in fake cek (RSA1.5)\n * BUG/MINOR: jwe: Buffer overflow when filling fake cek in case of RSA1.5\n * BUG/MEDIUM: pattern: don't dereference static_pattern's data when not filling it\n * BUG/MEDIUM: stick-table: restrict key sizes to what fits in a buffer\n * MINOR: stick-table: calculate the on-wire size of each key\n * MINOR: stick-table: provide a function to estimate on-wire data size\n * BUILD: haring: fix compile issue due to nop warning.\n * MINOR: stconn: prefer to replace endpoints rather than detaching them\n * BUG/MINOR: flt-http-comp: Rely on htx_set_eom() to restore EOM flag\n * BUG/MEDIUM: flt-http-comp: Block HTX_FL_EOM flag till the end of compression\n * MINOR: quic: implement the AEAD integrity limit\n * MEDIUM: jwt: Reject \"none\" alg in jwt_verify by default\n * [RELEASE] Released version 3.4.6\n * REGTESTS: log: check that a ring's internal server may target a UNIX socket\n * BUG/MEDIUM: server: skip log backend addr checks for internal proxies\n * BUG/MEDIUM: sink: reconnect attempt not working after session lasted more than ~25 days\n * BUG/MAJOR: mux_quic: fix potential crash on RESET_STREAM receive\n * MINOR: log: add the +utf8 encoding option to let valid UTF-8 pass\n * MINOR: log: pass the input end to the _lf_encode_bytes() byte encoders\n * [RELEASE] Released version 3.4.5\n * BUG/MINOR: mux-h2: Reject trailers received on a tunneled stream\n * REGTESTS: log: check the escaping performed by the +json option\n * BUG/MEDIUM: log: encode the whole non-printable range in the +json output\n * BUG/MEDIUM: mux_quic: activate timeout on FE init\n * BUG/MAJOR: mux_quic: fix leak on RESET_STREAM reception\n * BUG/MINOR: http-ana: restore the transaction status after early hints\n * BUG/MINOR: tcpcheck: refresh the start-line after updating the authority\n * BUG/MINOR: mux-h1: only mark C-L and T-E as sent once the header is emitted\n * BUG/MINOR: http-fetch: fix the space check of http_auth_bearer(\u003chdr\u003e)\n * BUG/MINOR: http-fetch: http_auth_bearer() must not match a missing header\n * BUG/MINOR: http-ana: count response body failures only once in http_fail_cnt\n * BUG/MEDIUM: tcp-rules: ignore \"capture len\" rules evaluated from a backend\n * BUG/MEDIUM: http-act: ignore \"capture len\" rules evaluated from a backend\n * BUG/MEDIUM: http-htx: don't build the new authority in a rotating trash chunk\n * BUG/MEDIUM: log: reserve the trailing 0 in CBOR int and bool encoders\n * REG-TESTS: http-messaging: Add a script to test interim responses for H1/H2\n * BUG/MINOR: mux-h2: Don't expect more HTX data on 1xx interim responses\n * BUG/MINOR: http-client: Convert server timeout ticks when setting it\n * BUG/MINOR: ssl: Fix possible null deref on the SSL context in ssl_sock_to_buf()\n * BUG/MINOR: hlua: release private Lua rule data on teardown\n * BUG/MAJOR: htx: Check the header/trailer length limits when one is updated\n * BUG/MINOR: tools: Don't try to anonymize a NULL string\n * BUG/MEDIUM: htx: Fix the position returned by htx_defrag()\n * BUG/MEDIUM: http-client/cli: Notify the http-client when the response is consumed\n * MINOR: http-client: Add a function to notify some data were consumed\n * BUG/MEDIUM: acme: Set HTTPCLIENT_O_RES_ACCUM option on the http-client\n * BUG/MEDIUM: ssl/ocsp: Set HTTPCLIENT_O_RES_ACCUM option on the http-client\n * MINOR: http-client: Add an option to not stop the reception of the response\n * BUG/MEDIUM: http-client: Don't use the httpclient context if it was released\n * BUG/MEDIUM: task: Do not destroy a task that is not ours in task_destroy\n * OPTIM: tools: keep a cache of recent localtime() and gmtime()\n * MAJOR: filters: Revert the filter-sequence directive\n * BUG/MINOR: proxy: pass PR_FL_DEF_EXPLICIT_MODE through cascaded defaults\n * BUG/MEDIUM: tcp-rules: Don't restart tcp-request content evaluation on yield\n * CLEANUP: stream: Remove an excess newline in the stream dump\n * BUG/MEDIUM: htx: Reserve a block descriptor for zero-sized blocks\n * BUG/MEDIUM: ssl: don't set a 0 timeout on an expired TLS session\n * DOC: configuration: clarify the validity ranges of sample types\n * REGTESTS: http-rules: check \"-m str\" on a sample with an embedded \\0\n * BUG/MINOR: sample: reject a \\0 byte in url_dec, json_query and jwt_*_query\n * BUG/MINOR: ssl: Fix leak of ca_list in cafile_entry\n * BUG/MINOR: cli: Reject payload with no command\n * BUG/MEDIUM: cli: Don't read a command or payload line into a full buffer\n * BUG/MEDIUM: cli: Don't parse next command if input buffer is empty\n * BUG/MEDIUM: http_act: fix normalize-uri normalizer selection with a condition\n * REGTESTS: map: check map_regm inside an ACL over an iterating fetch\n * BUG/MEDIUM: map: do not overwrite the fetch context in pat_match_regm()\n * BUG/MINOR: ssl: don't pass the address of a size_t as an int* to OpenSSL\n * BUG/MEDIUM: http-ana: apply tunnel timeout with data filters\n * BUG/MINOR: h3: only increment frame type counter on new header\n * BUG/MINOR: h3: handle unknown frame type on request stream as specified\n * BUG/MINOR: h3: handle empty HEADERS frame as specified\n * BUG/MEDIUM: h3: do not block FIN on empty DATA frame\n * BUG/MINOR: h3: reject truncated frames with mandatory payload\n * BUG/MINOR: stream/debug: harden the stream dump function regarding signals\n * BUG/MEDIUM: htx: Don't reset flags when source must be preserved during transfer\n * BUG/MINOR: hlua: Always return nil if there is no data to dup for HTTP messages\n * BUG/MINOR: mux-h1: Return an error on trailers if last chunk is unfinished\n * BUG/MEDIUM: hlua: Never release a cosocket applet from the GC\n * DOC: config: clarify tune tune.bufsize doc regarding various limits\n * BUG/MINOR: quic: leak of the NEW_TOKEN frame on token generation failure\n * BUG/MAJOR: h3: reject H3 truncated frames\n * BUG/MEDIUM: mux-h2: Make sure we remove H2_SF_NOTIFIED on subscribe\n * MEDIUM: mux-h1: Harden test for short data at end of stream\n * REGTESTS: log: check that the +cbor output passes the logged bytes through\n * DOC: config: mention that section 8.6 does not apply to the cbor encoding\n * REGTESTS: log: check which log-format tags escape control characters\n * REGTESTS: log: add a test for \"show events -s\"\n * MINOR: ring: add \"-s\" flag to \"show events\" to sanitize the output\n * BUG/MINOR: quic: delete the wrong CIDs when post-handshake frames fail\n * BUG/MINOR: qpack: accept a Required Insert Count which cannot be reached\n * BUG/MINOR: qpack: encoder and decoder stream data is never consumed\n * MINOR: quic: protect the ChaCha20 header protection context from being freed\n * CLEANUP: resolvers: stop clearing the DNS response buffer\n * BUG/MINOR: resolvers: classify empty truncated responses\n * BUN/MINOR: hlua: reset hlua_body variable after per-thread files loading\n * BUG/MEDIUM: filters: check the filter name before comparing it\n * BUG/MINOR: quic: late packets of the first key phase are dropped\n * BUG/MEDIUM: quic: crash on key update phase change after a failed one\n * BUG/MINOR: payload: bound ClientHello extension lists by the extension length\n * BUG/MINOR: payload: fix the cipher_len bound check in smp_client_hello_parse()\n * BUG/MEDIUM: mux-spop: Properly handle parsing of split HELLO/DISCONNECT frames\n * OPTIM: server: remember the lowest known unused server ID\n * BUG/MINOR: cache: Seed cache primary hash\n * BUG/MINOR: cache: Manage collisions on primary key\n- Update to version 3.4.3+git88.24ec4c12d:\n * BUG/MEDIUM: sink: do not create one implicit ring per logger copy\n * BUG/MEDIUM: sink: initialize the settings of the implicit log server\n * BUG/MINOR: flt-http-comp: Don't read next block to detect end of data\n * BUG/MINOR: fcgi-app: allow explicit filter declaration with non-cache/non-compression filters\n * BUG/MEDIUM: cache: ignore cache on redundant origin/referer\n * REGTESTS: converters: use connection: close in the has_ctl() test\n * MINOR: debug: check the match count in __BUG_ON_ONCE() and not in complain()\n * MINOR: sample: add new converter has_ctl() to detect control characters\n * DOC: haterm: add a missing 'haterm' build target on an example\n * BUG/MEDIUM: sink: do not hold the sft lock around ring_dispatch_messages()\n * BUG/MEDIUM: connection: fix an infinite loop in the fc_pp_tlv() fetch\n * MEDIUM: mux-h2: don't report EOM on a short content-length message\n * BUG/MEDIUM: mux-h1: close the connection on a short content-length\n","modified":"2026-10-24T16:45:03.949252778Z","published":"2026-10-23T17:11:42Z","references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1285046"}],"affected":[{"package":{"name":"haproxy","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/haproxy&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.7+git0.8872a2604-160000.1.1"}]}],"ecosystem_specific":{"binaries":[{"haproxy":"3.4.7+git0.8872a2604-160000.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22162-1.json"}}],"schema_version":"1.9.0"}